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Introduction: Is Intelligence Disclosure for Information Warfare? 


Russia's full-scale military invasion of Ukraine since February 2022 has continued as the biggest 
conventional warfare in European theater since the end of WW (hereafter the Russia-Ukraine War). In 
addition to myriad agendas of warfighting, this war has sparked renewed discussion on the multiple roles 
of “intelligence”! in 21st-century armed conflicts. Especially, strategic declassification and public disclosure 
of intelligence products (hereafter, "weaponized disclosure”) have attracted media and pundits' attention 
in Japan. Since December 2021, the US and UK have relentlessly exposed Russia's capabilities and 
intentions of its military invasion, from their military mobilization around the borders to the covert plan to 
install a pro-Russian proxy regime in Ukraine. While the Cold War history saw rare disclosure of intelligence, 
the US/UK initiatives have been unprecedented in their volume and speed of disclosure. 


The combination of the media coverage of the US/UK efforts and revisited interests in the roles of 
information in warfighting, as well as peacetime competition, have also shaped Japan's defense planners’ 
attention to weaponized disclosure. In accordance with key defense and strategic documents since 
December 2022, it has been regarded as one of the toolboxes of "Integrated Information Warfare with 
Special Regard to the Cognitive Dimension.” which Defense Intelligence Headquarters (DIH) under the 
Ministry of Defense is supposed to lead (inter-services) developments of doctrine and capability.’ 


Little dedicated analysis and scholarly discussion, however, has been done in Japan's strategic community 


NIDS Commentary, No. 224 


with reflection on the theoretical conundrum and historical continuity of the weaponized disclosure, which 
could have implications for the future trajectory of the doctrine and capability developments. Against this 
backdrop, the author shows that the US/UK weaponized disclosure is not in a vacuum from broader 
theoretical debates of intelligence studies and unique contexts of the Russia-Ukraine War, reflecting a 
growing body of academic literature and policy-oriented analysis. For this purpose, this commentary 
elaborates on the following two points. 


First, weaponized disclosure has always posed a critical “dilemma” to nation-state intelligence services, 
which requires them to strike a balance between creating effects by disclosure and controlling the risks of 
compromising sources and methods for future intelligence collection, scholarly called “disclosure 
dilemma.” It points out that strategic and operational conditions surrounding the Russia-Ukraine War 
have alleviated the severity of the disclosure dilemma, enabling exceptional scale and speed of their 
initiatives. 


Second, such enabling conditions have arisen from cumulative preparedness through 8 years of the 
transatlantic security corporation between the NATO allies and like-minded partners. In other words, the 
US/UK weaponized disclosure has leveraged hidden “inheritances.”, which have been shaped through 8 
years of collective regional security efforts from February 2014 toward February 2022. As such, the utility 
of similar initiatives may not be taken for granted in the other conflict modalities. Thus, scholars and 
practitioners should carefully analyze these attributes of the US/UK’s success and possible 
enablers/constraints surrounding future contingency scenarios. 


This NIDS commentary consists of the following blocks. The first section provides the basis for the 
subsequent discussion by summarizing the four pillars of intelligence-driven security cooperation before 
and after the full-scale invasion. The author sheds light on their precedents and linkage with allied 
intelligence-led campaigns against countering Russian hybrid threats in the second half of the 2010s. From 
Section 2 to Section 4, the author elaborates on the theoretical and practical conundrum of weaponized 
disclosure in the Russia-Ukraine War and beyond. These sections provide perspectives on the functions 
and limitations of weaponized disclosure as a policy means while highlighting controversy on the 
“disclosure dilemma,” which challenges the traditional intelligence apparatus's modus operandi and 
organizational culture. Reflecting theoretical debates, Section 5 analyzes unique contextual enablers for 
the US/UK-led initiatives underpinned by operational environments of the war as well as the broader 
European and transatlantic strategic landscape, leading to a conclusion of the analysis with future 
implications. 


1. Intelligence-led Allied Campaigns to preempt the Russian Moves. 


Transatlantic intelligence corporations began with the US-UK bilateral endeavors of collection and analysis 
of Russia's invasion plan. According to the investigative reporting of the British Broadcasting Corporation 
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(BBC), a classified source from a Western intelligence agency grasped signs of the invasion planning inside 
the inner circle of the Kremlin decision-making in the summer of 2021.* This early warning kicked off 
intensive bilateral efforts behind closed doors. Around autumn 2021, the U.S. government confirmed the 
certainty of Russia's possible invasion scenarios and then took the lead in following intelligence-led security 
corporations vis-a-vis other NATO members and the broader international audiences.’ In other words, 
weaponized disclosure is embedded into a part of the US and UK-led cumulative international responses 
to preempt Russian moves and defend allies and partners. These intelligence-led allied campaigns can be 
divided into four key pillars in accordance with the collection targets, granularity, and channels of 
intelligence sharing, as well as intended effects vis-a-vis target audiences. 


The first is “intelligence diplomacy.”, which involves sharing classified intelligence products privately with 
allies and partners to shape common situational awareness and coordinated policy responses. For example, 
the United States has conducted a series of shuttle diplomacy for classified briefings about possible Russian 
invasions with other NATO members. Such closed-door intelligence-sharing about Russian malicious 
behaviors for enabling the coordinated campaign to counter Russian threats has precedents’ in 2018, 
namely the international response to the Russian use of a chemical weapon in the UK known as the 
Salisbury incident as well as the recognition of Russia's violation of the Intermediate-Range Nuclear Forces 
(INF) Treaty.® 


The second pillar is the public disclosure of Russian capabilities and intentions about the full-scale invasion. 
On December 3, 2021, the Washington Post carried the declassified briefing material provided by the US 
intelligence community, with commercial satellite images highlighting the scale and locations of Russian 
forces mobilization near the border with Ukraine.? Subsequently, the US and the UK relentlessly publicized 
their analysis and estimate through multiple channels. Their contents (Figure 1) focused on reasonable 
harbingers which highlighted Russian capabilities (and intentions) for the possible invasion, including the 
mobilization updates, possible offensive routes, false flag operations in eastern Ukraine, and covert plots 
against the overthrow of Volodymyr Zelenskyy regime and the installation of Pro-Russian puppet regime. 
Even after the outbreak of the full-scale war, the US and UK governments have continued their initiatives 
to transmit the situational awareness of warfighting on the ground to multiple audiences, including the US 
Department of Defense briefings to journalists and the UK's Defense Intelligence (DI) initiatives to publicize 
the daily update of their intelligence estimate through social media such as Twitter."° 


Here, it should be noted that what has been and what's not declassified and publicized. Generally, what 
has been publicized is a finalized analysis instead of a source and methods itself, and major 
declassifications presented in Figure 1 are not equal in their granularity of evidence to support analysis. 
The US/UK initiatives are coordinated and nuanced efforts to balance effects by publication and protecting 
classified sources and methods." In other words, declassified content is the tip of the iceberg compared 
to the primary information collected and analyzed by the US and the UK, which forms its basis and the 


intelligence products believed to be shared under the surface with allies in “intelligence diplomacy." 
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Figure 1: Timeline of the US/UK Weaponize Disclosure from December 2021 to February 24, 2022 


Country 


Overview of the Declassified Contents 


December 3, 
2021 


US 


Leaked briefing material, including satellite images showing the mobilization 
of Russian military forces near the border with Ukraine and the bases where 
they were concentrated. It presented the estimate that there have been 
preparations for a military invasion from multiple fronts on the approximate 
scale of a maximum of 175,000 personnel, which would be ready by the 
beginning of 2022 at the earliest. 


January 14, 
2022 


US 


The official briefing to the press saying that Russia was deploying operatives 
to conduct false flag operations in eastern Ukraine to fabricate a pretext for 
the military invasion of Ukraine. It touched on the evaluation that the false flag 
operations would be implemented from the middle of January to the middle 
of February, and the military invasion could start several weeks after that. 


January 22, 
2022 


UK 


The official press release about the existence of a covert plot to overthrow the 
current regime and install a pro-Russian puppet regime. The release exposed 
the specific names of five Ukrainian nationals, including Yevhen Murayev, a 
former parliament representative and a candidate for the leadership of the 
puppet government, noting that the plot was conspired with the Russian 
intelligence agencies as a part of the Russian invasion planning. 


January 28, 
2022 


US 


Multiple leaks from US government officials said that the distribution of 
emergency medical supplies, such as blood for transfusions, to the mobilized 
forces along the border had begun, which was unusual for the regular exercise. 
This analysis could be one of the signs that the mobilization was intended for 
an actual military invasion instead of the Russian claim of military exercise. 


February 3, 
2022 


US 


The official briefing that Russia was creating propaganda images purporting 
to show massacres of residents in eastern Ukraine. The images themselves 
have not been publicized, but according to the Department of State 
spokesperson, the images include equipment falsely proving an attack by 
Ukrainian armed forces on ethnic Russian residents (e.g., the Turkey-made 
drone Bayraktar TB2, which is also used by the Ukrainian side), the site of the 
attack, the dead bodies of the victims and bereaved family members. 


February 13, 
2022 


US 


The US National Security Advisor expressed the evaluation that the military 
invasion by Russia could begin even before the closing of the Beijing Olympics 
(February 20, 2022). 


February 16 
- 17, 2022 


US/UK 


In response to the Russian government's claim of “withdrawal of Russian 
military forces from the border,” both the US and the UK presented the 
evaluation that the mobilization of Russian military forces along the border 
was continuing, and they could not confirm any information to verify the 
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Russian claim of withdrawal of mobilized forces. 


February 23, US The U.S. government leaked and let the world news outlets carry the fact that 
2022 the US had warned the Ukrainian government that the military invasion of the 
Russian military forces would commence within 48 hours. 


(Note) In advance of the US and the UK, in November 2021, the Ministry of Defence of Ukraine’? released an analysis, including 
of the scale of the mobilization of Russian military forces along the border and the anticipated invasion routes. 


(Source) Prepared by this author based on the officially published information of the governments of the US and the UK and 
the related media reports. 


The third dimension is leveraging “cyber threat intelligence (CTI)” for the network defense of public and 
private entities in Ukraine and the NATO member states. The most notable example is the US-led “hunt 
forward” missions (hereafter HFM), which deploy the U.S. Cyber Command personnel to the allies and 
partners (hereafter host-nations) proximate to the U.S. regional competitors to conduct combined network 
defense and threat-hunting activities with the host-nations.'* Within each deployment, threat-hunting 
efforts toward host-nations networks generate insights on technical artifacts as well as behavior tradecrafts 
of adversary’s campaigns, known as “Indicator of Compromise (loC),” and “Tactics, Techniques, and 
Procedures (TTPs),” respectively. The loC/TTPs obtained through HFM have been shared privately in 
relevant information/intelligence sharing channels for early warning for the network defenders of the U.S. 
and allies and partners’ organizations. In addition, such CTI often has been declassified to be shared with 
broader audiences outside of the closed information-sharing community. For example, occasional uploads 
of malware samples to Virus Total and Joint Cybersecurity Advisory, to which USCYBERCOM accelerated 
their contribution since 2018, represent such government-led disclosure of CTI to scale up outreach to 
domestic and international industries partners beyond traditional sharing channels." 


HFM originated as one of the USCYBERCOM proto-typing initiatives to preempt Russian election 
interference in 2018, and this root has underpinned its trajectory of development in the following years 
with its regional priority in the allies and partners in Europe. For the last 5 years since then, HFM has 
streamlined its operational effectiveness and efficiency through cumulative operational experiences with 
European host nations, including Ukraine.'®, as it provided the readiness to both USCYBEROM and 
European host nations through building mutual trust and interoperability.” USCYBERCOM, for example, 
deployed HFM teams to Ukraine in December 2021, and despite its shortened timeline of deployment 
facing an imminent danger of ground invasion, the team streamlined the process and succeeded in 
enhancing situational awareness and protection against the Russian threat against Ukraine's critical 
infrastructures and government networks.'® The US presence in neighboring NATO member states and 
readiness in cyberspace have maintained, even after the invasion broke out, to provide CTl-based early 
warning and network defense support to both Ukraine and the NATO member states." 


The fourth pillar is intelligence support to the Ukrainian Armed Forces.” The US /UK and the NATO-allied 
intelligence, surveillance, and reconnaissance (ISR) assets and their forward deployment posture in NATO's 
eastern flank played important roles (Figure 2).*' Since late 2021, some investigations have observed the 
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greater operational track records of the US/UK and NATO's joint aerial ISR assets over Poland and Romania, 
as well as the sky over the Black Sea.” These series of ISR activities contributed to collecting information 
about the locations of the Russian armed forces.” According to media coverages based on leaks, the US 
has leveraged these collection efforts to formulate finished intelligence products™ in order to help the air 
defense and other operations of Ukraine Armed Forces from the outset of the invasion while they officially 
maintained plausible deniability in their involvements.” 


Figure 2: Air-based ISR Readiness in the NATO Eastern Flank (As of May 10, 2022) 
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(Note) — refers to the US /UK and the NATO-allied aerial ISR assets actively operating from the end of 2021 onwards, either in the NATO Eastern 


Flank or the Black Sea regions, confirmed with various open-source reporting such as footnotes 20, 22, and 23 of this paper. 
(Source) : prepared by this author based on the picture of the NATO Allied Air Command at the following URL; “Allies Stand Together to Bolster NATO’s 
Eastern Flank,” NATO HQ Allied Air Command, May 10, 2022, https://ac.nato.int/archive/2022/nato_eAV_air. 


One common feature of the four initiatives above is the calculated use of publicity to maximize desired 


effects vis-a-vis specific target audiences. Despite their differences in the collection targets, granularity, 
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and channels of sharing, all of them deliberately unveiled their secrecy and tailored levels of visibility 
toward specific target audiences, including Russia, as well as the allies and partners. While this feature is 
most notable in weaponized disclosure (the second pillar), others represented the same trait; otherwise, 
they would have been subject to complete secrecy for their operational security and protection of 
collection sources and methods.*® In other words, all initiatives have carefully equated secrecy and 
publicity of initiatives, calculating respective rationales and tailoring their extents. With this point in mind, 


the next sections focus on theoretical and practical conundrums over weaponized disclosure in general. 


2. Conventional Wisdom on Nation-states Intelligence Disclosure. 


Theoretical and practical controversy over weaponized intelligence disclosure starts from and ends with 
the principle that intelligence is the world of secrecy. Conventional wisdom and practitioner norms 

suggest that intelligence should not be made public for reasonable concerns. Starting from this point is 
critical to understand the nature of weaponized intelligence disclosure, enablers, and constraints of the 


US/UK initiatives in the Russia-Ukraine War context, as well as future implications beyond this war. 


The biggest practical concern for nation-state intelligence services is that disclosing intelligence products 
and activities could jeopardize collection sources and methods. Any disclosure beyond the presentation 
of conclusions could have certain risks, as a reckless release of analyses allows the surveillance target or a 
third party to trace back to the sources and methods behind it as the contents and timing of release hint 
underlying evidence. Even without the target’s knowledge of the source and methods, just a suspicion of 
ongoing collection efforts often triggers the countermeasures by the target, such as hunting moles and 
changing encryption modes. It can lead to damaging consequences for the future collection capacity of 
intelligence services”. It goes without saying that the loss of sensitive assets could have a detrimental 
effect on the continuity of future collection and analysis efforts, and if the collection source is human 
intelligence (HUMINT), the risk is also a matter of life and death.” As such, it is natural that intelligence 


agencies have formed a strong organizational culture against the disclosure of intelligence.” 


Second, this practical concern also intertwines with theoretical and normative debate over the “core” and 
“periphery” of intelligence (activities). In essence, the narrower you define what intelligence should be, 
the stronger the skepticism against weaponized intelligence disclosure becomes. From overt counter- 


intelligence measures to covert action, theory and history of intelligence tell us that leveraging 
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intelligence to create visible effects against targets has always been controversial as it may pose risks to 
revealing one's secret hands and compromising clandestine capabilities.” For those who narrowly define 
the core of intelligence as (secret) collection and analysis to support decision-making or operational 
support for the future contingency, the initiative is perceived as too risky to legitimize its risks on 
collection sources and methods in the intelligence-gain/loss equation.** Against these backdrops, 
conventional wisdom has it that nation-state intelligence disclosure results from the politicization of 


intelligence, implying it is a negative sign eroding intelligence's core mission and code of conduct.” 


3. Logics and Caveats of Weaponized Disclosure for Intelligence-Effects. 


The growing body of academic literature in intelligence studies, however, has challenged the 
conventional wisdom in Section 2 by presenting empirical case studies of nation-state weaponized 
disclosure, which cannot be attributed to top-down political considerations and is more motivated by 
bottom-up national security/counter-intelligence considerations, such as Israeli military and intelligence 
efforts throughout the 2010s.¥ These findings can provide readers with the theoretical lens to grasp the 


following logics and caveats behind the US/UK-led weaponized disclosure. 


To begin with, previous studies have reached a consensus that a weaponized disclosure could have 
multiple “target audiences (hereinafter referred to as the “TA”)” on which nation-states try to influence 
and create desired effects through their behavior changes. In other words, a weaponized disclosure could 
have different ends and means vis-a-vis its TA”. It requires a granular understanding of multiple causal 
mechanisms and assumptions to bridge influence (on audiences) and desired effects without reducing 
such complexity into catch-all concepts such as “information warfare” and “deterrence by disclosure.” 
With this analytical lens in mind, US/UK-led weaponized disclosure in the Russia-Ukraine War represents 


the following four possible subsets of the audience-(desired)effects nexus. 


The first subset of the audience-effects nexus is the “disruption” of adversaries’ clandestine/covert 
campaigns, which its TA includes military/intelligence planners and operatives. Recent studies have 
theorized that intelligence disclosure could (temporally) disrupt the execution of certain military and 
intelligence activities if secrecy is indispensable for force protection and mission success. For instance, 
publicly exposing adversaries’ clandestine and covert operations results in subsequent counter- 
intelligence efforts to burn mission-critical assets and infrastructures, threatening their perception of 


operational security. These effects can force them to modify their planning and delay ongoing campaigns 
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because it forces them to rearrange their assets/infrastructures and to take measures to avoid another 
detection.” In addition, repeating the failure of operational security reduces decision-makers trust in the 
competence of their military/intelligence apparatus while it also induces paranoia in traitors among 
operational planners. Such psychological effects also cause friction in operational planning as they force 
planners to modify their ways of communication and increase cumulative costs and risks, leading to a 


greater chance of mission failure.*” 


"38 for policy-makers and public 


The second audience-effects nexus is the “sense/meaning-making 
opinions in third countries, including allies, partners, and swing-states between adversaries’ efforts. 
Preventive public exposure to adversaries’ malicious behaviors reduces uncertainty on situational 
awareness while it also underpins dominant narratives in information space with a first-mover advantage, 
which influences TA's perceptions and behavior patterns. These effects help to shape favorable 
international agendas to legitimize and convene collective policy responses and mitigate the negative 
consequences of adversarial information maneuvers. The UK's initiatives, called “prebuttal,” follow the 
same logic by preemptively exposing and refuting Russian disinformation before establishing its 


dominance in the global information space.” 


A logical question arises as to “why nation-state intelligence disclosure matters” about the 
sense/meaning-making effects. Specifically, “/s there a difference between (a) publicizing contents as a 
form of declassification of nation-state intelligence and (b) open-source reporting by private sectors/civil 
society, provided that the publicized contents themselves are the same?" Recent studies have suggested 
that the answer is “yes.”, elaborating the unique strength of nation-states’ disclosure to a unique dynamic 


of the 21° century's information environment. 


A strength of the nation-state’s public disclosure of intelligence is “augmented attention" vis-a-vis 
attention economy dynamics in the highly contested information sphere. Ofek Riemer points out that 
gaining TA’s attention to published content becomes more and more challenging with the exponential 
growth of volumes and speed of information flow, accelerated by the proliferation of ICT and the 
emergence of social media. Losing their traditional privilege, governments today have been competing 
with various private entities and individuals to win and retain the audience's attention to the information 
they try to disseminate. In this highly contested information environment, the declassification of 
intelligence is a catalyst to induce outstanding attention, leveraging the exceptionalness of revealing 
government secrets and the public trust in the intelligence agencies’ analytical competence in national 


security affairs.*° 
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This augmented attention by nation-states could catalyze and accelerate the following two dynamics of 


the information ecosystem. First is the “knowledge co-production"*' 


or “reciprocal investigative 
relationship and parallel evidencing"? between the public and private sectors. In some cases, the 
government declassification of analysis provides initial insights into targets with investigators in private 
sectors/civil society. This triggers their follow-up investigations and additional qualitative and 
quantitative information flow by their respective collection coverages. Such tacit feedback from private 
sectors and civil society efforts can benefit the government because it increases overall situational 
awareness of society and could alleviate intelligence-gain loss calculations of government sources in the 


long run.” 


The second dynamic is the “social construction of trustworthiness (through third-party verification)," which 
can be reinforced as a byproduct of the first dynamic. For example, the survey experiments and policy 
analysis by Erik Lin-Greenberg and Theo Milonopoulos suggest that private sector/ civil society 
verification of the government claims, utilizing commercial satellites, enhances the trustworthiness of the 
analyses and encourages stronger public support for the claims of the government.“ This third-party 
verification and trust construction dynamics could alleviate the problems of untrustworthiness of 


weaponized disclosure by nation-states’ intelligence apparatus (see the following Section 4). 


How can we assess the effectiveness and efficiency of the US/UK initiatives vis-a-vis these theoretical 
frameworks of weaponized disclosure? Firstly, the disclosure of substantial Russian covert/clandestine 
action plots, such as the puppet regime installation, has disrupted Russia's hybrid conflict strategy to 
achieve fait accompli and seize the escalation dominance without triggering the Ukraine military 
resistance and third-party support in the case of the annexation of the Crimea. The unprecedented 
scale/speed of US/UK initiatives from the end of 2021 has kept the attention of the world on the Ukraine 
situation, helping to shape the perception of an imminent and substantial risk of Russian invasion and 
the lack of legitimacy of the actions of Russia, which shaped baseline of the following international 
political, economic, and military supports to Ukraine.* In tandem with Kyiv’s initial military success, 
US/UK initiatives have disrupted Russia’s original Blitzkrieg and cumulatively increased their costs of 


waging a war of attrition. 


Second, weaponized disclosure in this war proves that “knowledge co-production” and “social 
construction of trustworthiness” dynamics have been amplified by an emerging open-source intelligence 
(OSINT) community practice. US/UK disclosure in December 2021 triggered the following open-source 


investigations by the research institutions and Russian/military experts, supplementing the validity of the 


-10- 
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US/UK analysis. Despite the controversy on the ill-standardization of practices of the OSINT community, 
rapid investigations/verification processes vis-a-vis government disclosure have prevented Russian 


disinformation and narrative from taking its dominance in the global information sphere.“ 


Third is a caveat of weaponized disclosure. It did not and will never be able to “deter.” resolved 
adversaries from overt and full-scale armed conflicts, despite policy-community narratives of 
“deterrence.”. Even if weaponized disclosure as a “disruption” could dissuade the adversarial actions, the 
logic is closer to the intelligence vs counterintelligence contests below the threshold of armed conflicts 
with both sides having an incentive to de-escalate, rather than the logic of warfighting and coercion 
leveraging the power to hurts and risk of escalation. The effectiveness of weaponized disclosure relies on 
the implicit assumption that revealing adversaries’ covert/clandestine activities could limit the intensity 
and frequency of future activities, as those exposed perceive the risks and incentive to keep restraints on 


their maneuvers for political escalation and operational security considerations.” 


Against these backdrops, it is not likely to change the behaviors of adversaries when they do not care 
about the consequences, and/or the exposure could constitute the desired effects to their target 
audiences”. It is not able to change the course of resolved actors, who are willing to escalate the 


situation from the gray zone to high-intensity conflicts supported by the overt use of the armed forces.” 


4. Disclosure Dilemma vis-a-vis Vicious Cycle of Trust Erosion. 


The biggest challenge of weaponized disclosure, as touched on in Section 2, is managing the “disclosure 
dilemma,” which require policymakers to calculate equity between creating military/policy effects for 
utilizing intelligence and protecting source and methods for future collection and analysis. This 
intelligence-gain/loss equation is not isolated within weaponized disclosure itself, but it can be 
intertwined with the broader implications of prioritization, resource allocation, and organizational- 
cultural preferences of intelligence activities. For example, Jake Harrington warns that reckless disclosure 
could incentivize intelligence services to be reluctant to share the analysis from classified sources as they 
perceive risks of politicized handling of products without considering the protection of sources and 
methods. Leveraging intelligence (disclosure) as a policy means requires an institutionalized equity 


process with reasonable concerns from the intelligence apparatus in the loop. °° 


Sais 


NIDS Commentary, No. 224 


That is easy to say but difficult to do. In practice, striking a balance between the desired effects of TA and 
keeping secrecy for future collection efforts has been very challenging for the following reasons. First, 
intelligence-gain loss judgment takes time and costs. Rationales for protecting sources and methods 
tend to justify the overclassification and make timely and scalable disclosure for the intended effects 
impossible. Second, keeping the quality and quantity of the disclosure is difficult due to the limited 
available resources. In some cases, governments may face no choice but to rush out the release of the 
finalized products without substantial evidence and analytical rigor. In this setting, the trustworthiness of 
the declassified analysis would only be guaranteed by inter-subjective trust, constructed from the TA’s 


perceptions of the intelligence agencies’ historical (in)competence.°' 


Finally, the more prolonged and repeated it becomes, the greater the risks to fall into a vicious circle of 
eroding trust and diminishing effects as it leads to the decline in augmented attention and perceived 
trustworthiness from the TA. As noted above, pursuing scale/scope of disclosure and protection of 
classified sources simultaneously would force intelligence agencies to give up transparency and quality of 
the publicized products. However, publicizing untransparent and unverified analysis is vulnerable to the 
adversaries’ information/narrative manipulation to damage the trustworthiness of the claims, whether the 
publicized analysis represents material(scientific) truth or not. Once the trust from TA has been damaged, 
and the bonus of the initial attention is likely to diminish like the fable of the “boy who cried wolf, it 


becomes extremely difficult to maintain the desired effects for a longer timeframe.” 


5. Enablers in the Russia-Ukraine War and Transatlantic Security Landscape? 


The challenges of the disclosure dilemma and vicious cycle of trust erosion is structural and have 
frequently appeared in the historical precedents, for example, collective public attribution to malicious 
cyber campaigns since 2017.” In this sense, the necessary question is, “What has alleviated the US/UK 
dilemma in the context of the Russia-Ukraine War, which can serve as enablers for unprecedented scale 
and speeds of the initiatives?” Answering this question, it is worth highlighting the following four factors 


vis-a-vis geopolitical contests of the transatlantic security landscape. 


One of the biggest enablers is the characteristic of the Russia-Ukraine War and its operational 
environment, which has shaped the nature of the collection coverage and information environments 
leveraged for weaponized disclosure. To begin with, the massive scale mobilization, logistics, and 


sustainment efforts of the Russian Armed Forces around the Ukraine border and in Belarus since 2021 
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are quite extraordinary. It is difficult to conceal and cannot be reasonably accounted for the Russian 
claims of the military exercise. In this setting, public disclosure of their mobilization and readiness around 
the border could allow military and intelligence experts to follow their heuristic analytical process for 
inferring the worst-case possibility of the Russian invasion in reference to material capabilities despite 


the uncertainty of the Kremlin's true intentions.” 


The US/UK’s declassification of the intelligence has exploited these material and inter-subjective 
attributes of the large-scale land warfare modality. Gaining insights from highly sensitive and 
unpublicizable collection coverage from their own sources as well as allies and partners, both countries 
have leveraged low-sensitive sources, namely commercial satellite imagery and publicly available social 
media data feeds about the Russian mobilization and maneuvers, to create the effects through 
declassification’’. For example, the U.S. declassification of satellite imagery in December 2021 was not 
sensitive as its sources have been commoditized with the growth of commercial satellite service 


providers. 


Second, and supported by the first point, the US/UK-led weaponized disclosure have been able to 
accelerate and leverage the chains of effects of knowledge co-production / reciprocal investigative 
relationship and parallel evidencing (see Section 3). Even a risk-controlled disclosure enabled by publicly 
available sources has sufficient effects to expose critical geographical nodes of the Russian mobilization 
and send a publicly available cue for the follow-up open-source investigation efforts by private/civil 
society players worldwide, including academics, think-tankers, and OSINT practitioners, which resulted in 
a reduction of source and methods compromise as the exponential flow of open-source data and 
analytic insights could provide a plausible cover for the government's sensitive sources and methods and 


supported the trustworthiness of the analyses.°° 


Third, the US/UK organizational learning vis-a-vis their experience has been critical because the 
weaponized disclosure requires shared commitments for institutionalizing the process from policymakers 
and intelligence services, given the latter's reluctance (See Section 4). For instance, the US intelligence 
community has surged declassification experts and concentrated additional resources to accomplish the 
accelerated intelligence-gain loss equity and maintain the quality of the analyses in response to the 
White House policy direction.” Such an extraordinary response relies on shared commitments among 
policymakers and intelligence agencies about the ends and means of the weaponized disclosure.” The 
US and UK have been shaping their learning and adaptation from (failure of) responses to the annexation 


of Crimea by Russia in 2014 and Russia's interference in the US presidential election in 2016.” 
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Finally, the cumulative outcomes of the transatlantic security corporation for countering Russian hybrid 
threats have ensured the readiness of the US/UK's weaponized disclosure. NATO and EU member states 
have developed their collective deterrence and resilience posture against hybrid threats since 2014, as a 
full spectrum of threats, from Russian nuclear/conventional forces to covert political interference against 
democracy, has been challenging them. Over 8 years of cumulative national and regional efforts have 
strengthened early-warning capacity from the allied ISR/cyber units and interoperability of the 
intelligence-driven allied campaigns within member states and beyond, namely intelligence-sharing with 
Ukraine. The fruits have also eased the challenges of the disclosure dilemma as it allows diversifications 
of available sources and coordinated diplomatic supports to supplement the trustworthiness of the 


analysis both through back-channel and public.*" 


In sum, the US/UK intelligence-driven allied campaigns, including weaponized disclosure in the Russia- 
Ukraine War, are not in a vacuum from a strategic depth of time and space. It has been predicated on the 
collective inheritances from the transatlantic regional security corporation vis-a-vis the resurgence of 


belligerent Russia in the era of great power competition. 


6. Conclusion. 


Bridging theoretical insights and empirical analysis of the Russia-Ukraine War's dynamics, this NIDS 
commentary concludes that the US/UK weaponized disclosure is not a vacuum in the sense that it poses 
challenges of disclosure dilemma to the intelligence services, and its effectiveness/efficiency is always 
context-dependent underpinned by their TA and strategic as well as operational environments. As such, it 
is worth highlighting the necessity of nuanced analysis and further discussion about the prospects of 
weaponized disclosure in specific dimensional and regional settings instead of underestimating the 


caveats of the initiative as depicting it as a silver bullet of information warfare. 


For example, there has been consensus that the utility of the US/UK weaponized disclosure before the 
full-scale invasion should be assessed vis-a-vis limitations of the viable ends and means. That is, the 
US/UK’s ruling out the options of direct armed conflict and escalation vis-a-vis Russia defined their viable 
theory of victory as disrupting Russia’s military fait accompli by supporting the Ukraine resistance and 
dragging Russia into the protracted war under strong international pressure, instead of deterring full- 
scale invasion itself. In this sense, the US/UK weaponized disclosure has served its achievable goals.” 


Beyond the case of the Russia-Ukraine War, armed conflicts underpinned by different operational 
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environments could shape the weaponized disclosure in different modalities vis-a-vis its strategic goals.© 
In this sense, future planning efforts also require an assessment of enablers and constraints for the 
weaponized disclosure of possible regional contingency beyond Europe, namely the Indo-Pacific and the 
Middle East. 


The author, however, also concludes that a generalizable and more substantial implication of the US/UK 
weaponized disclosure is having scholars and practitioners revisit the fundamental question of 


intelligence studies: “What intelligence means and what it should do and be like." 


This final point appears in the following two senses. First, the weaponized disclosure in the Russia- 
Ukraine War showed us dynamic knowledge/trust co-production dynamics between the government and 
stakeholders outside the traditional intelligence cycle, underpinned by the growth of private-sector cyber 
threat intelligence industries and civil-society-based OSINT community.” To be fair, the essentiality of 
secret intelligence remains constant, and secrecy will likely be an enduring philosophy of the nation-state 
intelligence apparatus®™. At the same time, contemporary national security challenges such as 
counterterrorism and cyber security in collaboration with non-government stakeholders have required 
Western intelligence services to adopt their roles and organizational culture, balancing between (1) 
secretive nature as intelligence apparatus for the customers of the traditional intelligence cycle, and (2) 
public-facing functions for intelligence-enabled homeland security. The US/UK moves in the Russia- 
Ukraine War, in this sense, represent the latest example of the continuous adaptation process of 
intelligence services®” vis-a-vis the dynamic security landscape underpinned by contested information 


environments in the 21st century. 


Second, the disclosure dilemma of the weaponized disclosure also reminds us of the recurring debate of 
the “core” and “periphery” of intelligence. Conventional academic wisdom has maintained differentiation 
between a narrower sense of “intelligence (collection and analysis)" and “actions (for effects),” and strong 
professional norms of the Western intelligence apparatus have taken it for granted that intelligence 
apparatus is and should be prioritizing collection and analysis over action. However, growing academic 
debate on covert actions and special operations has told us there have always been blurred lines 
between “intelligence” and “direct action,” national or organizational preference among various types of 


intelligence activities has been historically neither self-evident nor universal.” 


In conclusion, the discussion of weaponized disclosure requires both scholars and practitioners to be 


mindful of the following. questions: “what does intelligence mean in their national context, and what 
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national intelligence apparatus has been responsible for." as well as “whether and how weaponized 
disclosure, categorized as a form of intelligence-enabled effects functions like covert action, could be 


reconciled with their existing understanding, practices, and organizational culture of intelligence.” 
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